Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for Notifima by Unknown

    CVE-2026-78139 (GCVE-0-2026-78139)

    Vulnerability from nvd – Published: 2026-08-27 06:00 – Updated: 2026-08-27 06:00
    VLAI
    Title
    Notifima < 3.1.4 - Subscriber+ Stock Alert Unsubscription via IDOR
    Summary
    The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product stock-alert notifications.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/b1a0e23b-35f7-42… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Notifima Affected: 0 , < 3.1.4 (semver)
    		Create a notification for this product.
    Credits
    Shikhali Jamalzade WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Notifima",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.1.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Shikhali Jamalzade"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Notifima  WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product stock-alert notifications."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T06:00:19.934Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/b1a0e23b-35f7-4282-83f6-1917c89f7b4c/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Notifima \u003c 3.1.4 - Subscriber+ Stock Alert Unsubscription via IDOR",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-78139",
    "datePublished": "2026-08-27T06:00:19.934Z",
    "dateReserved": "2026-08-23T05:02:37.578Z",
    "dateUpdated": "2026-08-27T06:00:19.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-78139 (GCVE-0-2026-78139)

    Vulnerability from cvelistv5 – Published: 2026-08-27 06:00 – Updated: 2026-08-27 06:00
    VLAI
    Title
    Notifima < 3.1.4 - Subscriber+ Stock Alert Unsubscription via IDOR
    Summary
    The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product stock-alert notifications.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/b1a0e23b-35f7-42… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Notifima Affected: 0 , < 3.1.4 (semver)
    		Create a notification for this product.
    Credits
    Shikhali Jamalzade WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Notifima",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "3.1.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Shikhali Jamalzade"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Notifima  WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product stock-alert notifications."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T06:00:19.934Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/b1a0e23b-35f7-4282-83f6-1917c89f7b4c/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Notifima \u003c 3.1.4 - Subscriber+ Stock Alert Unsubscription via IDOR",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-78139",
    "datePublished": "2026-08-27T06:00:19.934Z",
    "dateReserved": "2026-08-23T05:02:37.578Z",
    "dateUpdated": "2026-08-27T06:00:19.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}